Hey everyone welcome to extracting data with bulk extractor.
In the previous video we looked at how to recover deleted files using the main open source carving tools
that come installed on Kalli Linux for most scalpel and photo rock we're going to introduce another
carving tool bulk extractor.
Its main features and highlight the differences with other carving tools then we're going to cover its
usage and main options showing an example of extracting bulk of data from a raúl disk image bulk extractor
is a Dana Carvey tool developed by Simpson Garfinkle and others to address the need of law enforcement
examiners for a highly automated tool to find as much information of interest as possible out of the
suspects media bulk extractor is a program written mostly in C++.
It could run on differe platforms like Windows Linux Mac et cetera like the other carving tools we saw
in the previous video.
It scans a disk image bypassing the file system but instead of recovering deleted files it extracts
data like e-mail address like email you are.
IP addresses credit card numbers and so on.
This tool saves the data in feature text files and also creates histogram files with the counter occurrences
for each data found.
Furthermore bulk extractor massively uses multi-threading.
It typically splits the disk up to 16 megabit pages and processes one page on each available core.
So it could be very fast especially on multi-core machines bulk extractor also produces an X M-L report
for each run a python tool has been developed to correlate reports from runs on different drives performing
a so-called Cross Drive analysis bulk extractor also provides a Gyi written in Java which is viewer
which is J s not be viewer.
Now that we introduced Baalke extractor Let's show its image with a practical example we could take
a look at the programs option running the command bulk extractor h less
the required perimeters are the image file and the o option that specifies the output directory to save
the extracted data.
Other interesting options are the r option that allows to specify the alert list.
The w option specifies the so-called stop list or whitelist if found it will be placed in a special
stopped file bulk extractor.
Also allows to specify a regular expression or a file of regular expressions to be used as search terms
with the lower and upper case f options respectively.
Also to enable or disable specific scanners with the E and x option
below there's also a list of scanners that are disabled by default but can be enabled with the option
and the scanners that are enabled by default and can be disabled with the x option.
In this example we use bulk extractor in the most straightforward way.
Simply executing the command on a sample image with the required parameters.
Now we run the tool.
We see that the bulk extractor uses 4 threads one for each row of the machine
now that the execution is complete.
We can take a look at the output directory
we notice there's several text files each one for different category of data.
Some of the categories of data also have an associated histogram file.
For example we'll analyze the email or text file
which reports one for each row.
The email extracted from the image each row starts with the offset in bytes where the corresponding
emails have been found.
We can also see that the associated history file reports the number of occurrences of each email
well-done in this section we introduced the file carving process and important concepts like slack unallocated
space and deleted files.
We also covered the recycle bin on Windows and a tool to examine it which was refuted too.
We covered file carving tools to automatically recover deleted files from a disk image which were foremost
scalpel and photographic.
Finally we saw how to use bulk extractor which is a tool that allows to extract much information like
deleted once from a disk image in the next section we're going to cover a forensic suite to fully analyze
and an automated way a disk image which is autopsy.